Live › vulnerability › CVE-2024-51378
Go to dashboardCyberPanel, a web hosting control panel, has incorrect default permissions that let an attacker bypass authentication. The flaw also allows arbitrary command execution through shell metacharacters in the statusfile property.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| CyberPersons CyberPanel | vendor | – | – |
| cyberpanel | vendor | < 2.3.8 | 2.3.8 |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus or /ftp/getresetstatus by bypassing secMiddleware (which is only for a POST request) and using shell metacharacters in the statusfile property, as exploited in the wild in October 2024 by PSAUX. Versions through 2.3.6 and (unpatched) 2.3.7 are affected.
This page as .md · .json · in your agent: get_signal("CVE-2024-51378")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.